A security expert has created a site (ransom tracker) to maintain a public record of Bitcoin payments made to notorious ransomware gangs, such as REvil.
The site ransomwarewhe.re was created by Jack Cable, a security researcher who works with the cyber consulting firm Krebs Stamos Group and the US Digital Defense Agency.
Read also: Ransomware: Could a ban on paying ransoms reduce attacks?
The site ransomwhere.re is an open ransomware payment tracker, offering analysis of Bitcoin payments made by victims to wallets associated with dozens of ransomware gangs. Payment data can be analyzed continuously and is relevant to this year, this month, and this week.
Ransomware attacks are on the rise, becoming a topic of discussion among leaders around the world, following cyberattacks on Colonial Pipeline, the largest US meat supplier, JBS, and software management company “Kaseya”, in which the REvil ransomware spread to dozens of service providers and affected over 1,500 businesses.
See also: Ransomware businesses: Negotiators are in high demand
Overall, Mailto/Netwalker ransomware leads the ransomware pack, but – considering payouts this year – REvil/Sadinokibi – which was behind the attacks on JBS and Kaseya – is in first place, with payouts totaling $11.3 million.
The REvil gang's profits for 2021 will increase significantlyif it receives the $70 million ransom it demanded last week after it "hit" Kaseya.
Cable joined the U.S. Cybersecurity and Infrastructure Security Agency under the then CISA director, Chris Krebs, to help secure the election systems before the U.S. 2020 presidential elections.
Cable explained his motivations for building the site in a Twitter thread, noting that data about victims' payments could change the response to ransomware.
Proposal: Industrial Control Systems (ICS): Target of ransomware gangs
Specifically, Cable wrote: “Today, there is no comprehensive public data on the total number of ransomware payments. Without this data, we cannot know the full impact of ransomware and whether taking specific actions changes the picture. Ransomwhere.re aims to fill this gap by tracking Bitcoin transactions associated with ransomware gangs. It is public, so anyone can view and download the data. Additionally, anyone can submit reports of ransomware they have been infected with or ransomware they have otherwise observed.”
According to the FAQ on ransomwhe.re, Bitcoin's transparency in payments facilitates the tracking of payments and receiving addresses. The site calculates the value of Bitcoin in US dollars based on the exchange rate of the day the payment was made, so it is an estimate of how much the victims paid.
Information source: zdnet.com
